FileVault in Intune: enabling encryption, escrowing recovery keys and fixing 0x87D1138D

FileVault through Intune happens in two stages: Intune first prepares the Mac to escrow its personal recovery key, then FileVault turns on, usually when the user signs out. When either stage stalls you end up with a Mac that isn't encrypted, a key that isn't in Intune, or error 0x87D1138D. In this post I'll explain the moving parts, decode the encryption report's status details, and fix each case, including Macs the user encrypted before Intune arrived.

Symptoms#

The encryption report shows one of these messages under Status details:

The recovery key hasn't been retrieved and stored yet. Most likely, the device hasn't been unlocked, or it hasn't checked in.
The user is deferring encryption or is currently in the process of encryption.
The device is already encrypted. Device user must decrypt the device to continue.
FileVault needs the user to approve their management profile in macOS Catalina and higher.

• The FileVault policy reports -2016341107 / 0x87d1138d, which Microsoft documents as "User hasn't accepted FileVault enablement prompt".
• An admin can't find Show recovery key for a Mac, or the user finds no key in the Company Portal website.
• Days after assignment, fdesetup status on the Mac still reports FileVault is Off.

Why it happens#

Escrow first, encryption second#

Intune only asks the Mac to encrypt after key escrow is set up. With deferral enabled, FileVault turns on when the user signs out (or at the next sign-in), so until then the report shows the "deferring encryption" message. A locked Mac can't continue either, which is one cause of an Unknown status. Microsoft also notes that FileVault encryption doesn't start until the Mac is plugged in, so a user can see a key for a Mac that isn't encrypted yet.

Management isn't user approved#

FileVault through MDM needs user-approved enrollment. Macs enrolled through Automated Device Enrollment qualify automatically; Macs enrolled with Company Portal need the user to approve the management profile, otherwise you see the "approve their management profile" message.

The user skipped the prompt#

0x87D1138D means the user hasn't accepted the enablement prompt. The bypass settings decide how long they can keep skipping it.

The Mac was already encrypted#

Intune can't set up FileVault on a Mac that's already encrypted and has no escrowed key. Intune escrows a key only when its policy encrypts the Mac or when the user uploads the key of a Mac they encrypted themselves.

Ownership hides the key#

Admins can view recovery keys only for Macs marked Corporate. For Personal Macs the key is escrowed for user self-service, but admins can't see it. That's by design, not a failure.

How to fix it#

1. Check the Mac. You want MDM enrollment: Yes (User Approved) and both a FileVault payload and a recovery key escrow payload in the installed profiles:
   Bash

   profiles status -type enrollment
   sudo profiles show -type configuration | grep -i -E 'filevault|fde'
   fdesetup status

   If enrollment isn't user approved, have the user approve the management profile in System Settings, or move the Mac to Automated Device Enrollment.
2. Use one clean policy. Create it in Endpoint security › Disk encryption › Create Policy (platform macOS, FileVault profile) with Enable = On, Use Recovery Key = Enabled, a Location message that tells users where to find their key, and optionally Recovery Key Rotation In Months. In the settings catalog (Full Disk Encryption), Microsoft states Defer must be Enabled for FileVault to apply. The macOS Endpoint protection template is deprecated, and two FileVault policies on one Mac just produce conflicts.
3. Get the user through the prompt. Ask them to sign out and back in and accept. To stop endless skipping, set Defer Force At User Login Max Bypass Attempts to a small number. FileVault can only be enabled by an account with a secure token, which you can check with sysadminctl -secureTokenStatus <username>.
4. Take over user-encrypted Macs. Keep the FileVault policy assigned, then use one of Microsoft's two methods:
   • The user signs in to the Company Portal website (portal.manage.microsoft.com), opens Devices, selects the Mac, chooses Store recovery key and enters the current key. Intune validates it and rotates to a new escrowed key.
   • If the user doesn't know the key, they run sudo fdesetup changerecovery -personal in Terminal and enter their password; the Mac generates a new key and Intune assumes management at the next check-in.
   Don't ask users to decrypt; Microsoft advises against it because the Mac stays unencrypted for a while.
5. Fix ownership. If a company Mac is marked Personal, change its ownership to Corporate in the device properties before looking for the key.
6. Speed things up. Select Sync on the device in the admin center, or have the user sync from Company Portal.

Verify the fix#

• Encryption report: Devices › Manage devices › Configuration, Monitor tab, Device encryption status. The Mac should show as encrypted with no status details. Reporting can take up to 24 hours, so sync after encryption finishes. Use Export to list every Mac reporting "already encrypted".
• Admin view: on a Corporate Mac, open the device, then Monitor › Recovery keys › Show Recovery Key. Every view is audited.
• User view: in the Company Portal website, Devices, then the Mac, then Get recovery key.
• On the Mac: confirm encryption and that the escrowed key really unlocks it:

fdesetup status                       # FileVault is On.
sudo fdesetup haspersonalrecoverykey  # true
sudo fdesetup validaterecovery        # paste the key from Intune; expect true

Prevent it next time#

• Use Automated Device Enrollment and Setup Assistant enforcement for new Macs, so encryption and escrow happen before the user signs in.
• Pair the policy with a compliance policy that requires encryption, so a skipped prompt has visible consequences.
• Write a clear Location message, and teach users the Company Portal website route before they need it.
• Mark company Macs Corporate at enrollment, and grant the Rotate FileVault key permission (Remote tasks) only to roles that need it.
• Using Platform SSO? Test FileVault unlock with it; see Platform SSO for macOS with Intune. The Windows equivalent of this guide is BitLocker recovery key not in Microsoft Entra ID.

References#

• Encrypt macOS devices with FileVault using Intune (Microsoft Learn)
• Monitor device encryption with Intune (Microsoft Learn)